@clear-capabilities/agentic-security-scanner 0.148.3 → 0.148.5

package/CHANGELOG.md

@@ -10,6 +10,67 @@
 
 
 
+## 0.148.5 - Third premortem pass on the --assurance strict fix: clean bill of health, four polish items closed anyway
+
+0.148.4's fix was put through a THIRD adversarial premortem pass to check whether it introduced
+anything new. It didn't — no High-or-above defect, and one specific hypothesis (a stale
+pre-0.148.4 cached scan producing the old, wrong message after upgrading) was investigated and
+disproven with direct evidence: `ci` always re-scans fresh, and the affected finding types never
+route through the disk-cached resolver path at all. Four Low-severity polish items surfaced
+anyway and are closed here, none of them changes to already-correct behavior:
+
+1. `cdn_no_integrity`/`dynamic_require` findings, alone with no other reason present, used to fall
+   through to a generic "share the same reason" message quoting the full raw internal string —
+   honest, but verbose, and missing the "(or drop to --assurance standard/advisory)" next step
+   every other named bucket already has. They now get their own short, specific message with that
+   same next step.
+2. The "MULTIPLE distinct reasons" message (fired when more than one category is present at once)
+   now renders as a bulleted, newline-separated list instead of one semicolon-joined paragraph —
+   each bullet is an independently actionable problem, and the old format buried that.
+3. `dynamic_require` and a standalone `no_lockfile` (previously only tested paired with
+   `unpinned_dep`) now each have their own direct test, closing a "shares a code path, never
+   independently verified" gap.
+4. A new completeness guard (`scanner/test/supply-chain-provenance-completeness.test.js`) asserts
+   every supply-chain finding type `engine.js` produces is deliberately classified as either a
+   genuine absence (no origin commit exists) or a real, resolvable-in-principle source location —
+   so a future finding type added to one detection loop and forgotten in the classification can't
+   silently tell a user a permanent limitation is fixable, or vice versa.
+
+## 0.148.4 - Adversarial premortem re-run on the 0.148.2/0.148.3 --assurance strict fix: two real defects found and fixed
+
+0.148.2's fix for a confusing `--assurance strict` failure was itself put through an adversarial
+premortem rather than trusted on its own say-so, the same discipline applied to the compliance-
+framework work earlier. It found the message-building logic held up in the common single-reason
+case, but had two real defects when a scan had more than one kind of provenance problem at once —
+which, on a real project, is not an edge case.
+
+1. **Multiple concurrent reasons silently collapsed to one.** A non-git directory with an
+   unpinned dependency produces BOTH a `'not a Git repository'` reason (every SAST/secrets/logic
+   finding) AND a `'origin resolution does not apply to...'` reason (the unpinned-dependency SCA
+   finding) on the very same scan — not hypothetically; `engine.js`'s two SCA populations that get
+   real git-history resolution are filtered to `type === 'vulnerable_dep'` only, so `unpinned_dep`/
+   `no_lockfile` never pass through the git-repo check at all. The message-building code picked
+   whichever reason had the most findings and silently dropped the other, so a user could fix the
+   reported problem (initialize git), rerun, and hit a second wall the tool had full information
+   about on the very first run but never mentioned — a milder recurrence of the exact "the tool
+   knew and didn't tell me" complaint the original fix existed to close. `_provenanceFailureReason`
+   (`scanner/src/pipeline/assurance-mode.js`) now reports every real category present, not just the
+   largest one.
+
+2. **Two structurally different SCA gaps were given the same, wrong advice.** `unpinned_dep`/
+   `no_lockfile` genuinely have no origin commit to resolve (they describe an absent declaration) —
+   correctly labeled a permanent, by-design limitation. But `cdn_no_integrity`/`dynamic_require`
+   both carry a real file:line (a specific `<script src>` tag or `require(...)` call someone wrote)
+   that a future resolver update genuinely could walk; `engine.js`'s provenance-stamping loop
+   previously gave all four types the identical limitation string, so the message-building code told
+   a user with a `cdn_no_integrity` finding to stop investigating a resolvable coverage gap because
+   it looked identical to a truly unresolvable one. `engine.js` now gives the two classes distinct,
+   honest limitation strings.
+
+Both landed with new regression tests (`scanner/test/assurance-mode.test.js`) covering the exact
+multi-reason interaction that exposed the first defect, and the cdn/dynamic-require case for the
+second. No behavior changed for the single-reason case most scans will actually hit.
+
 ## 0.148.3 - Dependency currency fix; supersedes 0.148.2, which never published
 
 The `v0.148.2` tag was pushed but its release workflow's dependency-currency gate failed on a

package/dist/4970.index.js

@@ -86,39 +86,115 @@ function _provenanceFailureReason(badProvenance, totalFindings) {
     counts.set(reason, (counts.get(reason) || 0) + 1);
   }
   const ranked = [...counts.entries()].sort((a, b) => b[1] - a[1]);
-  const [topReason, topCount] = ranked[0];
-  const allSameReason = ranked.length === 1;
   const base = `strict mode requires complete finding provenance; ${badProvenance.length}/${totalFindings} finding(s) have status outside [complete, uncommitted]`;
 
-  if (topReason === 'not a Git repository' || topReason === 'repository state unavailable') {
-    return `${base} — reason: ${allSameReason ? 'all of them are' : `${topCount} of them are`} "${topReason}". ` +
-      `strict mode resolves finding provenance from git history, so it requires a real git repository ` +
-      `(a GitHub "Download ZIP" extracts without one). Run \`git init && git add -A && git commit -m init\` in ` +
-      `the scanned directory, point the scan at a real \`git clone\`, or drop --assurance strict for standard/advisory.`;
+  const gitReasons = ranked.filter(([r]) => r === 'not a Git repository' || r === 'repository state unavailable');
+  const gitCount = gitReasons.reduce((s, [, n]) => s + n, 0);
+  // engine.js's own comment on this branch: "unpinned_dep / no_lockfile...
+  // describe the ABSENCE of a declaration, so 'which commit introduced this
+  // version' is not a question that has an answer to defer ... this is a
+  // known, disclosed limitation, not a bug... strict mode WILL fail on
+  // nearly any real project that has a package.json." That disclosure lived
+  // only in a source comment nobody hits this error reads — the README's
+  // own quickstart explicitly invites pointing --assurance strict at "your
+  // own project," where this is the single most likely outcome. Named here
+  // so the person who hits it learns it is expected and permanent, not
+  // something to keep investigating. This prefix is deliberately narrower
+  // than "every non-vulnerable_dep supply-chain entry" — engine.js's
+  // provenance-stamping loop only uses it for unpinned_dep/no_lockfile,
+  // which genuinely have no origin commit; cdn_no_integrity/dynamic_require
+  // carry a real file:line and get a DIFFERENT string precisely so they
+  // never land in this "permanent, give up" bucket (adversarial premortem
+  // R2, 2026-09-07 — conflating the two told a user a resolvable coverage
+  // gap was an unfixable, by-design limitation).
+  const supplyChainReasons = ranked.filter(([r]) => r.startsWith('origin resolution does not apply to a'));
+  const supplyChainCount = supplyChainReasons.reduce((s, [, n]) => s + n, 0);
+  // Third known bucket (S1, adversarial premortem third pass, 2026-09-07):
+  // cdn_no_integrity/dynamic_require's "not yet wired" string (see the
+  // engine.js comment this file's `supplyChainReasons` block already
+  // references) was previously falling through to the generic `otherReasons`
+  // path below — honest, but verbose, and with no recommended next step,
+  // unlike every other named bucket here. Giving it its own bucket closes
+  // that inconsistency without touching the two already-fixed buckets.
+  const notYetWiredReasons = ranked.filter(([r]) => r.startsWith('origin resolution is not yet wired for a'));
+  const notYetWiredCount = notYetWiredReasons.reduce((s, [, n]) => s + n, 0);
+  const knownReasonSet = new Set([...gitReasons, ...supplyChainReasons, ...notYetWiredReasons].map(([r]) => r));
+  const otherReasons = ranked.filter(([r]) => !knownReasonSet.has(r));
+  const otherCount = badProvenance.length - gitCount - supplyChainCount - notYetWiredCount;
+  const knownCategoryCount = (gitCount > 0 ? 1 : 0) + (supplyChainCount > 0 ? 1 : 0) + (notYetWiredCount > 0 ? 1 : 0);
+
+  // Exactly one KNOWN category, and nothing outside it — the shape every
+  // caller before this fix assumed was the only shape, and the one every
+  // existing test was written against. Kept as tight, single-topic prose
+  // rather than the multi-segment form below.
+  if (knownCategoryCount === 0) {
+    if (otherReasons.length === 1) {
+      return `${base} — all ${badProvenance.length} share the same reason: "${otherReasons[0][0]}".`;
+    }
+    const breakdown = otherReasons.slice(0, 5).map(([reason, n]) => `${n}× "${reason}"`).join(', ');
+    return `${base} — breakdown: ${breakdown}${otherReasons.length > 5 ? ', …' : ''}.`;
+  }
+  if (knownCategoryCount === 1 && otherCount === 0) {
+    if (gitCount > 0) {
+      const gitReasonNames = gitReasons.map(([r]) => `"${r}"`).join(' and ');
+      return `${base} — reason: ${gitCount === badProvenance.length ? 'all of them are' : `${gitCount} of them are`} ${gitReasonNames}. ` +
+        `strict mode resolves finding provenance from git history, so it requires a real git repository ` +
+        `(a GitHub "Download ZIP" extracts without one). Run \`git init && git add -A && git commit -m init\` in ` +
+        `the scanned directory, point the scan at a real \`git clone\`, or drop --assurance strict for standard/advisory.`;
+    }
+    if (supplyChainCount > 0) {
+      return `${base} — ${supplyChainCount} of them describe an ABSENT dependency declaration ` +
+        `(an unpinned version, a missing lockfile) that has no origin commit to resolve, by design. This is a ` +
+        `known, permanent limitation: strict mode cannot pass while any are present, on any real project with ` +
+        `such a dependency. Fix the underlying SCA finding(s) (pin the version / add a lockfile) if you want ` +
+        `strict to pass, or use --assurance standard/advisory for a project you don't control the dependencies of.`;
+    }
+    return `${base} — ${notYetWiredCount} of them point at a real source location (a CDN script tag, a dynamic ` +
+      `require) this engine can't yet trace back to the commit that introduced it — unlike the ABSENT-declaration ` +
+      `case above, this is an ordinary coverage gap, not a permanent limitation, but it isn't fixable from your ` +
+      `side either. Use --assurance standard/advisory if you need this scan to pass today.`;
+  }
+
+  // Two or more independently-blocking categories on the SAME scan — the
+  // defect this closes (adversarial premortem R1, 2026-09-07): the old
+  // code picked whichever category had the most findings and silently
+  // dropped every other one, so a user could "fix" the reported problem,
+  // rerun, and hit a second wall the first run already had full information
+  // about but never mentioned — the same "the tool knew and didn't tell me"
+  // complaint this whole function exists to fix, recurring in a milder form.
+  //
+  // Rendered as a bulleted, newline-separated list rather than one
+  // semicolon-joined paragraph (S2, adversarial premortem third pass,
+  // 2026-09-07) — each bullet is independently actionable, and a wall of
+  // clauses buried the fact that they are SEPARATE problems, each with its
+  // own fix, rather than one problem described three ways.
+  const segments = [];
+  if (gitCount > 0) {
+    const gitReasonNames = gitReasons.map(([r]) => `"${r}"`).join(' and ');
+    segments.push(`${gitCount} of them are ${gitReasonNames} — strict mode requires a real git repository; ` +
+      `run \`git init && git add -A && git commit\`, or scan a real \`git clone\`.`);
+  }
+  if (supplyChainCount > 0) {
+    segments.push(`${supplyChainCount} of them describe an ABSENT dependency declaration (unpinned version / ` +
+      `missing lockfile) with no origin commit to resolve — a known, permanent limitation, not something a ` +
+      `rerun will fix.`);
   }
-  // engine.js's own comment on this branch: "unpinned_dep / no_lockfile and
-  // friends... describe the ABSENCE of a declaration, so 'which commit
-  // introduced this version' is not a question that has an answer to defer
-  // ... this is a known, disclosed limitation, not a bug... strict mode
-  // WILL fail on nearly any real project that has a package.json." That
-  // disclosure lived only in a source comment nobody hits this error reads —
-  // the README's own quickstart explicitly invites pointing --assurance
-  // strict at "your own project," where this is the single most likely
-  // outcome. Named here so the person who hits it learns it is expected and
-  // permanent, not something to keep investigating.
-  const supplyChainCount = ranked.filter(([r]) => r.startsWith('origin resolution does not apply to a')).reduce((s, [, n]) => s + n, 0);
-  if (supplyChainCount > 0 && supplyChainCount >= badProvenance.length / 2) {
-    return `${base} — ${supplyChainCount} of them describe an ABSENT dependency declaration ` +
-      `(an unpinned version, a missing lockfile) that has no origin commit to resolve, by design. This is a ` +
-      `known, permanent limitation: strict mode cannot pass while any are present, on any real project with ` +
-      `such a dependency. Fix the underlying SCA finding(s) (pin the version / add a lockfile) if you want ` +
-      `strict to pass, or use --assurance standard/advisory for a project you don't control the dependencies of.`;
+  if (notYetWiredCount > 0) {
+    segments.push(`${notYetWiredCount} of them point at a real source location this engine can't yet trace ` +
+      `back to a commit — an ordinary coverage gap, not a permanent limitation, but not fixable from your side.`);
   }
-  if (allSameReason) {
-    return `${base} — all ${badProvenance.length} share the same reason: "${topReason}".`;
+  if (otherCount > 0) {
+    if (otherReasons.length === 1) {
+      segments.push(`${otherCount} share the reason "${otherReasons[0][0]}".`);
+    } else {
+      const breakdown = otherReasons.slice(0, 5).map(([reason, n]) => `${n}× "${reason}"`).join(', ');
+      segments.push(`${otherCount} break down as: ${breakdown}${otherReasons.length > 5 ? ', …' : ''}.`);
+    }
   }
-  const breakdown = ranked.slice(0, 5).map(([reason, n]) => `${n}× "${reason}"`).join(', ');
-  return `${base} — breakdown: ${breakdown}${ranked.length > 5 ? ', …' : ''}.`;
+  const bullets = segments.map((s) => `  - ${s}`).join('\n');
+  return `${base} — MULTIPLE distinct reasons, not just one:\n${bullets}\nEvery category above must be ` +
+    `resolved for strict to pass (or drop to --assurance standard/advisory) — fixing only one will surface the ` +
+    `next on your following run.`;
 }
 
 /**